From 73b146735cc283ea72ca826e82eabdbe6af81c09 Mon Sep 17 00:00:00 2001 From: AAA <35992542+TNTcraftHIM@users.noreply.github.com> Date: Fri, 21 Aug 2026 06:28:42 +0800 Subject: [PATCH] docs: record qh flagship deployment (#113) Record exact production revision, immutable artifact, cutover/rollback evidence, and the remaining production media-canary boundary. Preserve the subsequent Android-only source update as undeployed. --- docs/deployment.md | 36 ++++++++++++++++++++++++++++-------- docs/project-memory.md | 5 +++-- docs/status.md | 12 ++++++------ 3 files changed, 37 insertions(+), 16 deletions(-) diff --git a/docs/deployment.md b/docs/deployment.md index 5a26559..09f5bc6 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -13,26 +13,26 @@ current controller's automatic final media fallback. This capacity is dormant un `LIVEKIT_URL`/key/secret tuple is configured. It does not replace the P2P path, the peer-assisted experiment, or required STUN discovery. LiveKit remains ICE/UDP only. Source no longer contains the rejected participant-wide Peer ICE TURN -candidate; stale `PEER_ICE_TURN_*` keys fail startup even when blank. A -the selected-edge source tuple is enabled in production only for the controller's +candidate; stale `PEER_ICE_TURN_*` keys fail startup even when blank. The +selected-edge source tuple is enabled in production only for the controller's single exceptional edge. Production ordinary peer ICE remains STUN-only and the tracked coturn example remains `stun-only`; the shared host retains its older authenticated-relay daemon configuration and firewall range. The application does not pre-advertise TURN credentials to ordinary peers. -Production currently runs exact `fd76277b05d491af8840b28f3132b7ff445d3cbe` +Production currently runs exact `22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` on the existing shared public IP, with local/public health 200 and SQLite v3 -integrity. The 915,377-byte artifact has SHA-256 -`8da4b8b2b1ae4b82add615f4367ee447b5ade86c4e58a938e51085940b9867d3`. -The 2026-08-20T20:53:59Z UTC cutover held the deployment lock for 8,389 ms; -local health returned 520 ms after service stop (478 ms after the symlink +integrity. The 660,626-byte artifact has SHA-256 +`3cbd8f6be82fa615fa2861ff1be0eba6c98f3f7d9acb73a0ba5c21a2ff4c661c`. +The 2026-08-20T22:17:43Z UTC cutover held the deployment lock for 1,696 ms; +local health returned 508 ms after service stop (479 ms after the symlink switch). Screener, LiveKit, coturn, and nginx are active/running with `NRestarts=0`. SQLite v3 contains five rooms including room `1`, with the service owner/mode and database hash preserved. `SITE_ACCESS_PASSWORD`, `/api/site-access`, and the nginx limiter replaced their retired Host-admission names in the prior access cutover; this release preserved the environment hash and the old endpoint remains 404. Exact -`5e4a3679076a9ea2fe7a41fadf4be65a439db450` +`fd76277b05d491af8840b28f3132b7ff445d3cbe` is the immediate rollback target. The selected-edge UDP tuple is configured with TTL 120, but no real TURN/SFU media canary was triggered; this remains a bounded configuration smoke, not @@ -475,6 +475,26 @@ and exact `cf149df2411798cd632cc92a562b0a35146e0c1b` became the rollback release No browser, TURN, SFU, or media canary was run, so this is deployment/config evidence only. +The LiveKit two-layer RID fix cutover used exact source +`22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` and immutable artifact +`screener-22119b907d3cf03ce8b06d6fb4596ce1a26fedd7-20260820T221200Z-git.tar.gz` +(660,626 bytes, SHA-256 +`3cbd8f6be82fa615fa2861ff1be0eba6c98f3f7d9acb73a0ba5c21a2ff4c661c`). +The exact source passed typecheck, both builds, and 30 test files/440 tests. +The one lock-held cutover completed at 2026-08-20T22:17:44.589825032Z; +the lock was held for 1,695.676 ms, stop-to-health took 507.877 ms, and +symlink-to-health took 479.483 ms. The release and its immediate +`fd76277b05d4` rollback share zero regular-file inodes. + +Environment, nginx, LiveKit, coturn, nftables, listener, and SQLite hashes were +unchanged. SQLite v3 retained five rooms including room `1` with owner/mode +`screener:screener`/0600. Local/public health, root, room `1`, the built asset, +site-access status, and the retired-endpoint 404 passed; all four services were +active/running with their observed `NRestarts=0`. No browser, SFU media, TURN, +or performance canary ran. This deploys the `q,h` guard and preserves exact +`fd76277b05d491af8840b28f3132b7ff445d3cbe` as the rollback release; the one-SFU- +root functional evidence remains the separate localhost Chrome run. + Enabling persistence does not migrate rooms that existed only in memory. The deployment restart invalidates those temporary links; the first subsequently created persistent room receives ID `1`. diff --git a/docs/project-memory.md b/docs/project-memory.md index 227ce4f..fbf2404 100644 --- a/docs/project-memory.md +++ b/docs/project-memory.md @@ -42,7 +42,8 @@ Last updated: 2026-08-21 ## Current Implementation - The repository is one npm package using Node.js 24, React, TypeScript, Vite, native WebRTC, `ws`, Zod, Vitest, and separate coturn. -- Production serves exact `fd76277b05d491af8840b28f3132b7ff445d3cbe` at `https://share.bonfire.icu`. The immutable artifact is 915,377 bytes with SHA-256 `8da4b8b2b1ae4b82add615f4367ee447b5ade86c4e58a938e51085940b9867d3`; the 2026-08-20T20:53:59Z UTC cutover held the deployment lock for 8,389 ms and reached local health in 520 ms from stop (478 ms from symlink switch). Exact `5e4a3679076a9ea2fe7a41fadf4be65a439db450` is the immediate rollback release. +- Production is exact `22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` at `https://share.bonfire.icu`; its 660,626-byte artifact SHA-256 is `3cbd8f6be82fa615fa2861ff1be0eba6c98f3f7d9acb73a0ba5c21a2ff4c661c`. The 2026-08-20T22:17:43Z cutover took 1,696 ms lock/508 ms stop-health/479 ms switch-health. Rollback is exact `fd76277b05d491af8840b28f3132b7ff445d3cbe`. +- Source is ahead at Android-only exact `b8b6994efe4da3a773e16cec370e2a5ce7cbbf93`; it is not deployed. - The current Screener, LiveKit, coturn, and nginx services are active/running with `NRestarts=0`; local and public health are 200. SQLite v3 is intact with five rooms including room `1`, and the DB owner/mode remain `screener:screener`/0600. - Production ICE remains ordinary STUN-only. `PEER_ASSISTED_MEDIA=true` enables the controller for every normal room, and selected-edge TURN is configured for the single UDP tuple with TTL 120; the coturn daemon and nginx/LiveKit/firewall/listener baselines were unchanged. No production SFU/TURN media canary or quality claim is implied. - Production requires the independent site-access secret through `SITE_ACCESS_PASSWORD`. Its stateless cookie authorizes creation/Host and permits code-only Viewer attempts; valid private fragment grants remain direct. Public-watch accepts site access plus code, while private code-only entry additionally requires the room password. The env, endpoint, cookie, and nginx limiter naming migrated atomically; anonymous failures stay neutral, and there are no accounts/JWT/session rows. @@ -50,7 +51,7 @@ Last updated: 2026-08-21 - ADR-0005 source rejects `PEER_ASSISTED_ROOM_IDS`; `PEER_ASSISTED_MEDIA=true` enables every room, while ordinary peer ICE stays STUN-only. A stale room-ID variable fails startup. `screener-v2` is the only deployed signaling literal; there is no v1 parser or translator. - Chrome 151/LiveKit localhost A/B cut failure-to-active/render from 1.481/2.257 seconds to 0.200/0.320; 31 new frames and 25 ms sampling kept host edges at two. It is headless synthetic 720p30 and includes SDK/network prewarm, not public-network evidence. - Chrome 151 synthetic topology/quality runs kept fanout 2/1 and decoding; one relay close recovered in 5.32 seconds. Control evidence only. -- Latest source matches LiveKit 2.22.0's two-layer `q,h` sender layout. Chrome 151 against local LiveKit 1.13.5 retained one SFU/UDP root with increasing inbound/decoded/rendered counters and clean client leaves; TURN was absent and no performance claim follows. Production deployment, zero-child BWE, and calibrated C+B loss remain open. +- Deployed Web source uses LiveKit 2.22.0's two-layer `q,h` layout. Local Chrome 151/LiveKit 1.13.5 kept one SFU/UDP root with growing inbound/decoded/rendered counters, clean leaves and no TURN. Production SFU media, zero-child BWE, and calibrated C+B loss remain open. - C+B uses three hard-bad pairs, one-use samples and guarded intent/cooldown. Deployed admission rescue moves the oldest childless zero-capacity Host leaf below an unassigned one-slot relay in one revision; no score/timer/global rebalance. Deployment passed, but no real room triggered it. - Web Host name/presence and window-audio hint are deployed. Native accepts bounded peer-assisted direct children and fails unsupported SFU/selected ingress; it has no LiveKit/TURN media. Its WGC/MF H.264 direct-child smoke rendered 203 frames plus 500 Opus packets and matched helper PID/LUID `VideoEncode`; packaging is source-only, unreleased and undeployed. VP8 remains the Web/production default. See `docs/research/native-h264-opt-in-path.md`. diff --git a/docs/status.md b/docs/status.md index f277dd9..1cc0823 100644 --- a/docs/status.md +++ b/docs/status.md @@ -4,8 +4,8 @@ Last updated: 2026-08-21 ## Phase -`https://share.bonfire.icu` serves exact `fd76277b05d491af8840b28f3132b7ff445d3cbe`; the 915,377-byte artifact SHA-256 is `8da4b8b2b1ae4b82add615f4367ee447b5ade86c4e58a938e51085940b9867d3`. -The cutover held the lock 8,389 ms and returned local health 520 ms after stop. SQLite v3 has five rooms; Screener, LiveKit, coturn and nginx are healthy with zero restarts. +Production is exact `22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` at `https://share.bonfire.icu`; its 660,626-byte artifact SHA-256 is `3cbd8f6be82fa615fa2861ff1be0eba6c98f3f7d9acb73a0ba5c21a2ff4c661c`. +Cutover took 1,696 ms lock/508 ms stop-health. SQLite v3 has five rooms; four services are healthy with zero restarts. Android-only source `b8b6994efe4da3a773e16cec370e2a5ce7cbbf93` is ahead and not deployed. Ordinary ICE is STUN-only; all rooms use the bounded peer/SFU-UDP controller and selected-edge UDP TTL 120. Room `1` is historical smoke; production SFU/TURN media remains unverified. Web names/audio hint are deployed. Native WGC/MF/package is source-only; Web defaults VP8. @@ -21,7 +21,7 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo - Native v2 is source-only (memory rooms, 300s reclaim); it follows authenticated direct-child assignments up to two and fails unsupported SFU/selected ingress boundedly. - PR #44's STUN-only/SFU-UDP router and token-free fallback prewarm are process-enabled for all normal rooms: roots <=2, browser relay <=1, bounded failure. Room `1` is historical smoke; mobile/iPad viewers are leaves, healthy edges sticky, and HTTPS/WSS stays TLS/TCP. - After an answer, a generation-bound 15s initial-connect deadline enters ICE restart; success/replacement/disposal cancels it. It is deployed but not mobile-verified. -- Latest source fixes LiveKit's two-layer `q,h` sender guard; production predates it. +- Production includes LiveKit's two-layer `q,h` sender guard; its functional media proof remains local, not production. - Room `1` C+B reparenting remains uncalibrated. Deployed admission rescue promotes an unassigned one-slot relay over the oldest childless zero-capacity Host leaf, with no scores or periodic optimization. - Web roster includes Host self-name and requests window-scoped display audio where supported; both are hints, and Native wire/media is unchanged. @@ -38,11 +38,11 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo - Native wire/session tests enforce at most two authoritative children, no presence-created edge, stale-revision ignore, and one bounded unsupported-route failure per revision. - Source adds selected Host ingress and peer last-mile for every enabled room; focused routing/config tests pass with Peer ICE STUN-only. - Host names, the window-audio hint, all-room routing, and all-room Host selected ingress are active; the stale restart assertion is historical only. -- The `fd76277` gate preserved the environment and SQLite hashes, v3/five rooms/room `1`, selected-edge/SFU/ordinary-ICE settings, services, and local/public health plus route/asset 200s. Site access returned the unauthenticated status and the retired endpoint returned 404; no TURN/SFU session ran. Exact `5e4a3679076a9ea2fe7a41fadf4be65a439db450` is the rollback release. +- Exact `22119b9` passed typecheck, both builds and 30 files/440 tests. Deploy preserved environment, ingress/media/firewall/listener/SQLite hashes, v3/five rooms/room `1`, route settings, services and local/public/route/asset 200s. Site access stayed required, the retired endpoint remained 404, and no TURN/SFU session ran. Rollback is exact `fd76277b05d491af8840b28f3132b7ff445d3cbe`. ## Unverified Boundaries -- The final deployment proves process/config health, not a retained SFU frame, retry/failback, selected UDP pair, admission rescue, edge cap, quality, or resource deltas; game-share load/blur remains unclassified. +- The `22119b9` deployment proves process/config health, not a retained production SFU frame, retry/failback, selected UDP pair, admission rescue, edge cap, quality, or resource deltas; game-share load/blur remains unclassified. - Mobile Web Host unsupported; Viewer leaf-only. Android 14+ direct source/default-off selected-UID audio passed six protocol tests/`assembleDebug`. No device/audible claim; mediaProjection-only background, opt-out/silence/A-V, SFU/rotation remain open. iOS deferred; TV output P2. - Silent partitions can wait 30 to 60 seconds for heartbeat detection before the default 5-second grace; this remains unverified. - The former release reportedly sustained bandwidth-limited blur on a capable LAN; Host refresh recovered while Viewer refresh did not. The new deployment has not yet reproduced or cleared it. @@ -54,7 +54,7 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo ## Next Milestone -Deploy the `q,h` fix; one bounded production room `1` canary must retain UDP, a rendered frame, edge caps, and clean stop. TURN/performance follow later. +Run one bounded production room `1` canary that retains UDP, a rendered frame, edge caps, and clean stop. TURN/performance follow later. Recovery uses one ICE restart, one same-parent rebuild, one alternate peer, then SFU. Next gate exactly-two/Dynacast-off BWE on a zero-child SFU leaf, then root evacuation. Native WGC/MF passed one-Viewer hardware; package download, Viewer2/FIFO and game A/V remain. Benchmark later. Ordinary Peer ICE stays STUN-only. Selected-edge Host ingress still needs one forced-relay canary before a media-success claim.